arbret: our side of running it on vipy

prd-arbret was folded into vipy. arbret itself (app, worker, Postgres, timers,
its backup dump) is deployed by its owner's own repo; this repo owns the
shared host's side of it. arbret_handoff.md documents the split, the Gatus
push API and the backup contract.

- services/arbret: arbret.com -> localhost:3100, www redirects to the apex,
  port 4117 allowed on tailscale0 only, /opt/backups/arbret pre-created to
  the contract so the pull job is green before the first dump.
- headscale ACL: framie may reach prd-vipy:4117.
- vipy: arbret-server, arbret-worker and postgresql in the unit checks.
- 402: DNS and HTTP checks for arbret.com, www, and /api/health with
  [BODY].status == ok. Entries may now name an fqdn outside root_domain and
  add conditions.
- 403: probes arbret-analytics (hourly, 130m window) and arbret-beancount
  (daily, 26h), pushing with the dedicated arbret token.
- backups: pull from backup-pull@prd-vipy:/opt/backups/arbret/, and a
  backup-dump_arbret endpoint.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ansible/infra/403_service_probe_registration.yml

@@ -59,6 +59,15 @@
       - {name: xmrblocks,        host: monerod_box_local}
       - {name: navidrome,        host: music_box_local}
       - {name: jar-lid-archive-staging, host: jar_lid_staging_local}
+      # arbret (on vipy, deployed by the arbret repo). `host` here is the KEY in
+      # gatus_push_tokens, and arbret has a dedicated `arbret` token rather than
+      # vipy's - so it cannot write vipy's own results, and vice versa.
+      # Windows are two runs plus slack, as for the 5m probes above:
+      #   analytics  hourly at :00       -> 130m
+      #   beancount  daily at 03:00      -> 26h
+      # Cadence lives in the arbret repo; tell us if it changes.
+      - {name: arbret-analytics, host: arbret, heartbeat: '130m'}
+      - {name: arbret-beancount, host: arbret, heartbeat: '26h'}
 
     # The alert every probe gets. failure-threshold is 1 - the heartbeat window
     # is the tolerance, see the note above - unless a probe sets